GL.iNet AX1800
Approved changes feed: RSS · Atom
cpe:2.3:h:gl-inet:ax1800:-:*:*:*:*:*:*:*
part: h version: - update: *
| Vendor | Gl Inet (0ba6498a-0971-5dec-92da-bb83b4dab2f2) |
|---|---|
| Product | Ax1800 (901a6439-c0c8-5527-87ac-8b5e953c9679) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-67091 |
not_vulnerable | 2026-06-08 07:41:19.694560 |
Details available
An issue in GL Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable. GL.Inet AX1800 Version 4.6.4 & 4.6.8 in the GL.iNet custom opkg wrapper script located at /usr/libexec/opkg-call. The script is executed with root privileges when triggered via the LuCI web interface or authenticated API calls to manage packages. The vulnerable code uses shell redirection to create a lock file in the world-writable /tmp directory.
Published: 2026-01-08T00:00:00.000Z
Updated: 2026-01-08T16:10:44.603Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-67090 |
not_vulnerable | 2026-06-08 07:41:19.693814 |
Details available
The LuCI web interface on Gl Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable. Fix available in version 4.8.2 GL.Inet AX1800 Version 4.6.4 & 4.6.8 lacks rate limiting or account lockout mechanisms on the authentication endpoint (`/cgi-bin/luci`). An unauthenticated attacker on the local network can perform unlimited password attempts against the admin interface.
Published: 2026-01-08T00:00:00.000Z
Updated: 2026-01-08T16:51:52.244Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-45263 |
not_vulnerable | 2026-06-08 06:45:55.742038 |
Details available
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The upload interface allows the uploading of arbitrary files to the device. Once the device executes the files, it can lead to information leakage, enabling complete control.
Published: 2024-10-24T00:00:00.000Z
Updated: 2024-10-28T18:52:30.245Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-45262 |
not_vulnerable | 2026-06-08 06:45:55.709373 |
Details available
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The params parameter in the call method of the /rpc endpoint is vulnerable to arbitrary directory traversal, which enables attackers to execute scripts under any path.
Published: 2024-10-24T00:00:00.000Z
Updated: 2024-10-28T19:22:25.505Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-45261 |
not_vulnerable | 2026-06-08 06:45:55.705729 |
Details available
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The SID generated for a specific user is not tied to that user itself, which allows other users to potentially use it for authentication. Once an attacker bypasses the application's authentication procedures, they can generate a valid SID, escalate privileges, and gain full control.
Published: 2024-10-24T00:00:00.000Z
Updated: 2024-10-28T19:19:59.290Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-45260 |
not_vulnerable | 2026-06-08 06:45:55.701921 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-45259 |
not_vulnerable | 2026-06-08 06:45:55.674214 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-39229 |
not_vulnerable | 2026-06-08 06:41:48.898728 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-39228 |
not_vulnerable | 2026-06-08 06:41:48.896073 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-39227 |
not_vulnerable | 2026-06-08 06:41:48.882094 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-39226 |
not_vulnerable | 2026-06-08 06:41:48.859631 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-39225 |
not_vulnerable | 2026-06-08 06:41:48.837937 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-28077 |
not_vulnerable | 2026-06-08 06:33:26.405027 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-27356 |
not_vulnerable | 2026-06-08 06:31:28.623552 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.